CVE-2025-68028: 
WordPress vulnerability analysis and mitigation

CVE-2025-68028 is a Missing Authorization (Broken Access Control) vulnerability in the GA4WP: Google Analytics for WordPress plugin developed by Passionate Brains. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, affecting all plugin versions from n/a through 2.10.0. The vulnerability was published on February 20, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Wordfence).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions or exposing functionality. Because no authentication or capability checks are enforced on the affected endpoints, any unauthenticated network-accessible attacker can trigger restricted plugin functionality. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit (Feedly).

Successful exploitation can result in limited integrity and availability impacts on the affected WordPress site — specifically, an unauthenticated attacker may be able to modify plugin settings or disrupt analytics-related functionality. Confidentiality is not directly impacted according to the CVSS scoring. While the scope is unchanged and lateral movement potential is limited, unauthorized modification of Google Analytics configuration could lead to data loss or analytics data poisoning (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-68028 as of the available data. The EPSS score is very low at approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Users of the GA4WP: Google Analytics for WordPress plugin should update to a version beyond 2.10.0 as soon as a patched release is made available by Passionate Brains. In the interim, site administrators should consider deactivating the plugin if it is not critical to operations, or restricting access to the WordPress admin area using IP allowlisting or a web application firewall (WAF). Monitoring plugin activity logs for unexpected changes to analytics settings may help detect unauthorized access (Feedly, Wordfence).

Wordfence included CVE-2025-68028 in their weekly WordPress vulnerability report for the period of February 2–8, 2026, as part of routine disclosure coverage. No significant independent researcher commentary or broader media coverage has been identified for this vulnerability (Wordfence).